<html>
<head><meta charset="utf-8"><title>Undefined behavior detected by miri · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html">Undefined behavior detected by miri</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="215392530"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215392530" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> marmeladema <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215392530">(Nov 02 2020 at 23:20)</a>:</h4>
<p>Hello everyone!</p>
<p>I have recently been working on a crate that encode a linked list in a vec and I (tried to at least^^) implemented a mutable iterator.<br>
Classically, I introduced an <code>IterMut</code> struct that holds a mutable reference to the list (that holds the vec) but in order to return reference that outlives the iterator, I had to use some bits of unsafe code by "bypass" the borrow checker.<br>
I thought it was fine, until I added a test that was collecting all the yielded mutable refs in a vec and tried to modify it ...<br>
This is where miri started to complain of ub: <a href="https://github.com/marmeladema/clru-rs/pull/20/files">https://github.com/marmeladema/clru-rs/pull/20/files</a></p>



<a name="215392635"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215392635" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> marmeladema <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215392635">(Nov 02 2020 at 23:22)</a>:</h4>
<p>The illegal magic is probably introduced here: <a href="https://github.com/marmeladema/clru-rs/blob/2d0ead8eea98c6518a557d199104e507659e2aee/src/lib.rs#L348">https://github.com/marmeladema/clru-rs/blob/2d0ead8eea98c6518a557d199104e507659e2aee/src/lib.rs#L348</a></p>



<a name="215392690"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215392690" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> marmeladema <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215392690">(Nov 02 2020 at 23:23)</a>:</h4>
<p>Is there a way to please miri &amp; the borrow checker at the same time? I don't exactly know what are my options</p>



<a name="215392805"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215392805" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> marmeladema <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215392805">(Nov 02 2020 at 23:24)</a>:</h4>
<p>I tried to use only safe APIs available on slices like <code>split_mut_at</code> but since I am not walking my node in the memory order I does not really work</p>



<a name="215392814"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215392814" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215392814">(Nov 02 2020 at 23:25)</a>:</h4>
<p><span class="user-mention" data-user-id="281572">@marmeladema</span> don't you just need <code>&amp;'a mut self</code>?</p>



<a name="215392840"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215392840" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> marmeladema <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215392840">(Nov 02 2020 at 23:25)</a>:</h4>
<p>in the definition of <code>next</code>? You cannot because it's not how the trait is defined</p>



<a name="215392853"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215392853" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215392853">(Nov 02 2020 at 23:25)</a>:</h4>
<p>oh hmm</p>



<a name="215392858"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215392858" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215392858">(Nov 02 2020 at 23:25)</a>:</h4>
<p>I think you need GATs</p>



<a name="215392921"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215392921" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215392921">(Nov 02 2020 at 23:26)</a>:</h4>
<p>as is, it's unsound because you could have a mut ref and an immutable borrow at the same time (if you drop the <code>&amp;mut self</code> just after returning)</p>



<a name="215392931"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215392931" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> marmeladema <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215392931">(Nov 02 2020 at 23:26)</a>:</h4>
<p>but technically, it's a similar problem to mutable iteration over a slice, which do exists. I looked at how it's implemented in the stdlib but could not really understand how that would NOT be tripping miri</p>



<a name="215393117"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215393117" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215393117">(Nov 02 2020 at 23:29)</a>:</h4>
<p>yeah that looks like the same pattern for <code>IterMut</code></p>



<a name="215393648"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215393648" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> marmeladema <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215393648">(Nov 02 2020 at 23:34)</a>:</h4>
<p>In the <code>IterMut</code> of <code>LinkedList</code> in stdlib, there are those lines in the code:</p>
<div class="codehilite"><pre><span></span><code>                // Need an unbound lifetime to get &#39;a
                let node = &amp;mut *node.as_ptr();
</code></pre></div>
<p>I tried to do something similar, and it also trips miri :(</p>



<a name="215393884"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215393884" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> marmeladema <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215393884">(Nov 02 2020 at 23:37)</a>:</h4>
<p>The actual error looks like:</p>
<div class="codehilite"><pre><span></span><code>test tests::test_iter_forwards ... error: Undefined Behavior: no item granting read access to tag &lt;295525&gt; found in borrow stack.
    --&gt; src/lib.rs:1276:17
     |
1276 |                 **v -= 1;
     |                 ^^^^^^^^ no item granting read access to tag &lt;295525&gt; found in borrow stack.
     |
     = help: this indicates a potential bug in the program: it performed an invalid operation, but the rules it violated are still experimental
     = help: see https://github.com/rust-lang/unsafe-code-guidelines/blob/master/wip/stacked-borrows.md for further information
</code></pre></div>



<a name="215394355"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215394355" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> marmeladema <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215394355">(Nov 02 2020 at 23:43)</a>:</h4>
<p>Tried to implement something similar on vec in the playground: <a href="https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=7000e7cf32926ba6b107e2abcf380084">https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=7000e7cf32926ba6b107e2abcf380084</a> and miri does not seem to complain, but maybe it's because it cannot see "what happens inside stdlib"?</p>



<a name="215394515"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215394515" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215394515">(Nov 02 2020 at 23:45)</a>:</h4>
<p>Not sure how helpful this is, but I tried to simplify your example to a <a href="https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=a4d622aaff2e72646c590234a691748d">mwe</a>:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">cache</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">CLruCache</span>::<span class="n">new</span><span class="p">(</span><span class="mi">3</span><span class="p">);</span><span class="w"></span>
<span class="w">    </span><span class="n">cache</span><span class="p">.</span><span class="n">put</span><span class="p">(</span><span class="s">"a"</span><span class="p">,</span><span class="w"> </span><span class="mi">1</span><span class="p">);</span><span class="w"></span>
<span class="w">    </span><span class="n">cache</span><span class="p">.</span><span class="n">put</span><span class="p">(</span><span class="s">"b"</span><span class="p">,</span><span class="w"> </span><span class="mi">2</span><span class="p">);</span><span class="w"></span>
<span class="w">    </span><span class="n">cache</span><span class="p">.</span><span class="n">put</span><span class="p">(</span><span class="s">"c"</span><span class="p">,</span><span class="w"> </span><span class="mi">3</span><span class="p">);</span><span class="w"></span>

<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="n">v</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">        </span><span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">it</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">cache</span><span class="p">.</span><span class="n">iter_mut</span><span class="p">();</span><span class="w"></span>
<span class="w">        </span><span class="kd">let</span><span class="w"> </span><span class="n">v</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">it</span><span class="p">.</span><span class="n">next</span><span class="p">().</span><span class="n">unwrap</span><span class="p">();</span><span class="w"></span>
<span class="w">        </span><span class="n">it</span><span class="p">.</span><span class="n">next</span><span class="p">().</span><span class="n">unwrap</span><span class="p">();</span><span class="w"></span>
<span class="w">        </span><span class="n">v</span><span class="w"></span>
<span class="w">    </span><span class="p">};</span><span class="w"></span>
<span class="w">    </span><span class="o">*</span><span class="n">v</span><span class="p">.</span><span class="mi">1</span><span class="w"> </span><span class="o">-=</span><span class="w"> </span><span class="mi">1</span><span class="p">;</span><span class="w"></span>
</code></pre></div>
<p>It seems that the UB is triggered when you move the iterator on to the second element and then access an old element</p>



<a name="215394631"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215394631" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215394631">(Nov 02 2020 at 23:47)</a>:</h4>
<p>oh this might be a provenance issue</p>



<a name="215395054"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215395054" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> marmeladema <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215395054">(Nov 02 2020 at 23:52)</a>:</h4>
<p>It's a step in the right direction I guess. Thanks! Not sure I know enough to fix this myself though :/</p>



<a name="215395209"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215395209" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215395209">(Nov 02 2020 at 23:54)</a>:</h4>
<p><a href="https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=d28957e7fd836b047ecb8ccc7ae1e169">more minimal</a></p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">cache</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">FixedSizeList</span>::<span class="n">new</span><span class="p">(</span><span class="mi">3</span><span class="p">);</span><span class="w"></span>
<span class="w">    </span><span class="n">cache</span><span class="p">.</span><span class="n">push_front</span><span class="p">(</span><span class="mi">1</span><span class="p">);</span><span class="w"></span>
<span class="w">    </span><span class="n">cache</span><span class="p">.</span><span class="n">push_front</span><span class="p">(</span><span class="mi">2</span><span class="p">);</span><span class="w"></span>
<span class="w">    </span><span class="n">cache</span><span class="p">.</span><span class="n">push_front</span><span class="p">(</span><span class="mi">3</span><span class="p">);</span><span class="w"></span>

<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">it</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">cache</span><span class="p">.</span><span class="n">iter_mut</span><span class="p">();</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="n">v</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">it</span><span class="p">.</span><span class="n">next</span><span class="p">().</span><span class="n">unwrap</span><span class="p">().</span><span class="mi">1</span><span class="p">;</span><span class="w"></span>
<span class="w">    </span><span class="n">it</span><span class="p">.</span><span class="n">next</span><span class="p">().</span><span class="n">unwrap</span><span class="p">();</span><span class="w"></span>
<span class="w">    </span><span class="o">*</span><span class="n">v</span><span class="w"> </span><span class="o">-=</span><span class="w"> </span><span class="mi">1</span><span class="p">;</span><span class="w"></span>
</code></pre></div>



<a name="215395249"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215395249" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> marmeladema <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215395249">(Nov 02 2020 at 23:55)</a>:</h4>
<p>hu I managed to get it to pass</p>



<a name="215395392"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215395392" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> marmeladema <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215395392">(Nov 02 2020 at 23:56)</a>:</h4>
<p>If I avoid the call to <code>node_mut()</code> in <code>next</code> and do <code>let node = list.nodes[front].as_mut().unwrap();</code> instead it works</p>



<a name="215395418"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215395418" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> marmeladema <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215395418">(Nov 02 2020 at 23:57)</a>:</h4>
<p>but doing <code>let node = list.nodes.get_mut(front).and_then(|node| node.as_mut()).unwrap();</code> (copied from <code>node_mut()</code>) does not</p>



<a name="215395527"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215395527" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> marmeladema <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215395527">(Nov 02 2020 at 23:58)</a>:</h4>
<p>what kind of dark magic happens in <code>get_mut()</code> or <code>and_then</code> that would make miri complain oO?</p>



<a name="215395555"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215395555" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215395555">(Nov 02 2020 at 23:58)</a>:</h4>
<p>this is what I meant  by provenance</p>



<a name="215395570"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215395570" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215395570">(Nov 02 2020 at 23:58)</a>:</h4>
<p>the first one only borrows <em>one</em> of the elements of the slice</p>



<a name="215395580"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215395580" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215395580">(Nov 02 2020 at 23:59)</a>:</h4>
<p>the second borrows the <em>whole</em> slice, then gives you one element from it</p>



<a name="215395613"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215395613" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215395613">(Nov 02 2020 at 23:59)</a>:</h4>
<p>so if you have two elements at once using the second method, then the 'provenence' 'remembers' that you borrowed the whole slice to start, and now you have two mutable references to the slice</p>



<a name="215395759"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215395759" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> marmeladema <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215395759">(Nov 03 2020 at 00:00)</a>:</h4>
<p>I would have honestly thought that <code>list.nodes[front]</code> would be strictly equivalent to <code>list.get_mut(front).unwrap()</code></p>



<a name="215396050"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215396050" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> marmeladema <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215396050">(Nov 03 2020 at 00:04)</a>:</h4>
<p>Is there other ways/syntax to borrow only one element of a slice?</p>



<a name="215396060"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215396060" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> marmeladema <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215396060">(Nov 03 2020 at 00:04)</a>:</h4>
<p>Besides <code>slice[idx]</code> I mean</p>



<a name="215396168"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215396168" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215396168">(Nov 03 2020 at 00:06)</a>:</h4>
<p>I would be inclined to do this with raw pointers, although the available syntax for doing this is lacking</p>



<a name="215396352"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215396352" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> marmeladema <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215396352">(Nov 03 2020 at 00:09)</a>:</h4>
<p>Even though miri can be a little cryptic, it's really such a <em>great</em> tool</p>



<a name="215396594"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215396594" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215396594">(Nov 03 2020 at 00:12)</a>:</h4>
<p>I managed to get this to work:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="k">struct</span> <span class="nc">FixedSizeListIterMut</span><span class="o">&lt;'</span><span class="na">a</span><span class="p">,</span><span class="w"> </span><span class="n">T</span><span class="o">&gt;</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="n">list</span>: <span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="n">FixedSizeList</span><span class="o">&lt;</span><span class="n">T</span><span class="o">&gt;</span><span class="p">,</span><span class="w"></span>
<span class="w">    </span><span class="n">front</span>: <span class="kt">usize</span><span class="p">,</span><span class="w"></span>
<span class="w">    </span><span class="n">len</span>: <span class="kt">usize</span><span class="p">,</span><span class="w"></span>
<span class="w">    </span><span class="n">_lft</span>: <span class="nc">std</span>::<span class="n">marker</span>::<span class="n">PhantomData</span><span class="o">&lt;&amp;'</span><span class="na">a</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">FixedSizeList</span><span class="o">&lt;</span><span class="n">T</span><span class="o">&gt;&gt;</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>

<span class="k">impl</span><span class="o">&lt;'</span><span class="na">a</span><span class="p">,</span><span class="w"> </span><span class="n">T</span><span class="o">&gt;</span><span class="w"> </span><span class="nb">Iterator</span><span class="w"> </span><span class="k">for</span><span class="w"> </span><span class="n">FixedSizeListIterMut</span><span class="o">&lt;'</span><span class="na">a</span><span class="p">,</span><span class="w"> </span><span class="n">T</span><span class="o">&gt;</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="k">type</span> <span class="nc">Item</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="p">(</span><span class="kt">usize</span><span class="p">,</span><span class="w"> </span><span class="o">&amp;'</span><span class="na">a</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">T</span><span class="p">);</span><span class="w"></span>

<span class="w">    </span><span class="cp">#[allow(unsafe_code)]</span><span class="w"></span>
<span class="w">    </span><span class="k">fn</span> <span class="nf">next</span><span class="p">(</span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="bp">self</span><span class="p">)</span><span class="w"> </span>-&gt; <span class="nb">Option</span><span class="o">&lt;</span><span class="bp">Self</span>::<span class="n">Item</span><span class="o">&gt;</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">        </span><span class="k">if</span><span class="w"> </span><span class="bp">self</span><span class="p">.</span><span class="n">len</span><span class="w"> </span><span class="o">&gt;</span><span class="w"> </span><span class="mi">0</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">            </span><span class="kd">let</span><span class="w"> </span><span class="n">front</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="bp">self</span><span class="p">.</span><span class="n">front</span><span class="p">;</span><span class="w"></span>
<span class="w">            </span><span class="c1">// Safety: This creates a copy of a mutable reference to the list.</span>
<span class="w">            </span><span class="c1">// This is unsafe in Rust, see "The Rules of References" at</span>
<span class="w">            </span><span class="c1">// https://doc.rust-lang.org/book/ch04-02-references-and-borrowing.html#the-rules-of-references.</span>
<span class="w">            </span><span class="c1">// We need to do this because self.list only exists as long as the iterator does,</span>
<span class="w">            </span><span class="c1">// but the iterator's result items must live longer than the iterator itself.</span>
<span class="w">            </span><span class="c1">// See https://stackoverflow.com/a/30422716/2013738 for details on reference items outliving iterators.</span>
<span class="w">            </span><span class="kd">let</span><span class="w"> </span><span class="n">node</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">                </span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="o">*</span><span class="n">core</span>::<span class="n">ptr</span>::<span class="n">raw_mut</span><span class="o">!</span><span class="p">((</span><span class="o">*</span><span class="bp">self</span><span class="p">.</span><span class="n">list</span><span class="p">).</span><span class="n">nodes</span><span class="p">[</span><span class="n">front</span><span class="p">])</span><span class="w"></span>
<span class="w">            </span><span class="p">}.</span><span class="n">as_mut</span><span class="p">().</span><span class="n">unwrap</span><span class="p">();</span><span class="w"></span>
<span class="w">            </span><span class="bp">self</span><span class="p">.</span><span class="n">front</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">node</span><span class="p">.</span><span class="n">next</span><span class="p">;</span><span class="w"></span>
<span class="w">            </span><span class="bp">self</span><span class="p">.</span><span class="n">len</span><span class="w"> </span><span class="o">-=</span><span class="w"> </span><span class="mi">1</span><span class="p">;</span><span class="w"></span>
<span class="w">            </span><span class="nb">Some</span><span class="p">((</span><span class="n">front</span><span class="p">,</span><span class="w"> </span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">node</span><span class="p">.</span><span class="n">data</span><span class="p">))</span><span class="w"></span>
<span class="w">        </span><span class="p">}</span><span class="w"> </span><span class="k">else</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">            </span><span class="nb">None</span><span class="w"></span>
<span class="w">        </span><span class="p">}</span><span class="w"></span>
<span class="w">    </span><span class="p">}</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</code></pre></div>



<a name="215396630"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215396630" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215396630">(Nov 03 2020 at 00:13)</a>:</h4>
<p>I'm pretty sure this is kosher, since it doesn't actually materialize the <code>&amp;mut</code> until it has the relevant pointer first</p>



<a name="215396779"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215396779" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> marmeladema <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215396779">(Nov 03 2020 at 00:15)</a>:</h4>
<p>So yeah, I originally used a *mut and a PhantomData but ultimately switched to a regular mutable ref because I was not really needing the raw pointer</p>



<a name="215396810"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215396810" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> marmeladema <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215396810">(Nov 03 2020 at 00:15)</a>:</h4>
<p>This is what I ended up merging: <a href="https://github.com/marmeladema/clru-rs/commit/bba2538920e23a24c544078fda7b2f118fc31eb8">https://github.com/marmeladema/clru-rs/commit/bba2538920e23a24c544078fda7b2f118fc31eb8</a></p>



<a name="215396913"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215396913" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215396913">(Nov 03 2020 at 00:17)</a>:</h4>
<p>I think that <code>list_ref</code> is still a bit risky; it's not caught by miri because you don't do anything with it besides build another path</p>



<a name="215396937"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215396937" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215396937">(Nov 03 2020 at 00:17)</a>:</h4>
<p>unfortunately my alternative uses <code>raw_mut!</code> which is still unstable</p>



<a name="215397210"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215397210" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> marmeladema <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215397210">(Nov 03 2020 at 00:21)</a>:</h4>
<p>Hum and would storing directly a pointer+length to the slice be better? And using from_raw_parts_mut?</p>



<a name="215397327"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215397327" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215397327">(Nov 03 2020 at 00:23)</a>:</h4>
<p>Yeah, you can do that on stable too</p>



<a name="215397457"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215397457" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> marmeladema <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215397457">(Nov 03 2020 at 00:24)</a>:</h4>
<p>What about just:</p>
<div class="codehilite"><pre><span></span><code>if self.len &gt; 0 {
            let front = self.front;
            let node = self.list.nodes[front].as_mut().unwrap();
            self.front = node.next;
            self.len -= 1;
            Some((front, unsafe { &amp;mut *(&amp;mut node.data as *mut T) }))
}
</code></pre></div>



<a name="215397482"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215397482" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> marmeladema <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215397482">(Nov 03 2020 at 00:25)</a>:</h4>
<p>I moved the unsafe block at the very end</p>



<a name="215397776"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215397776" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215397776">(Nov 03 2020 at 00:29)</a>:</h4>
<p><a href="https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=583b567653bfbe3a35609083a3ea1542">here's</a> an implementation where the iterator stores a pointer to the element:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="k">struct</span> <span class="nc">FixedSizeListIterMut</span><span class="o">&lt;'</span><span class="na">a</span><span class="p">,</span><span class="w"> </span><span class="n">T</span><span class="o">&gt;</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="n">list</span>: <span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="nb">Option</span><span class="o">&lt;</span><span class="n">FixedSizeListNode</span><span class="o">&lt;</span><span class="n">T</span><span class="o">&gt;&gt;</span><span class="p">,</span><span class="w"></span>
<span class="w">    </span><span class="n">front</span>: <span class="kt">usize</span><span class="p">,</span><span class="w"></span>
<span class="w">    </span><span class="n">len</span>: <span class="kt">usize</span><span class="p">,</span><span class="w"></span>
<span class="w">    </span><span class="n">_lft</span>: <span class="nc">std</span>::<span class="n">marker</span>::<span class="n">PhantomData</span><span class="o">&lt;&amp;'</span><span class="na">a</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">FixedSizeList</span><span class="o">&lt;</span><span class="n">T</span><span class="o">&gt;&gt;</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
<span class="o">..</span><span class="p">.</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="n">node</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="o">*</span><span class="bp">self</span><span class="p">.</span><span class="n">list</span><span class="p">.</span><span class="n">offset</span><span class="p">(</span><span class="n">front</span><span class="w"> </span><span class="k">as</span><span class="w"> </span><span class="kt">isize</span><span class="p">)</span><span class="w"> </span><span class="p">}.</span><span class="n">as_mut</span><span class="p">().</span><span class="n">unwrap</span><span class="p">();</span><span class="w"></span>
</code></pre></div>



<a name="215397952"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215397952" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> marmeladema <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215397952">(Nov 03 2020 at 00:32)</a>:</h4>
<p>Is the link right? It seems to point to a code not using a pointer</p>



<a name="215398085"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215398085" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> marmeladema <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215398085">(Nov 03 2020 at 00:34)</a>:</h4>
<p>But I understand your proposal nonetheless :) yeah that would work too</p>



<a name="215398105"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215398105" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> marmeladema <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215398105">(Nov 03 2020 at 00:34)</a>:</h4>
<p>I don't really know what would be the "best way" though</p>



<a name="215398230"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215398230" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215398230">(Nov 03 2020 at 00:36)</a>:</h4>
<p>I think the definitions are still a bit undetermined, so I generally err on the side of caution, not creating <code>&amp;mut</code> references unless they are actually dynamically valid</p>



<a name="215398258"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215398258" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215398258">(Nov 03 2020 at 00:36)</a>:</h4>
<p><code>*mut</code> pointers are a bit more ugly to work with but they don't make any lifetime related promises</p>



<a name="215398322"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215398322" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215398322">(Nov 03 2020 at 00:37)</a>:</h4>
<p>and the "lifetime cast" <code>unsafe { &amp;mut *(&amp;mut node.data as *mut T) }</code> in your version looks like the sort of thing that might conceivably be banned in the future with really strict reference types</p>



<a name="215952811"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215952811" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215952811">(Nov 07 2020 at 12:27)</a>:</h4>
<p><span class="user-mention silent" data-user-id="281572">marmeladema</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri/near/215395759">said</a>:</p>
<blockquote>
<p>I would have honestly thought that <code>list.nodes[front]</code> would be strictly equivalent to <code>list.get_mut(front).unwrap()</code></p>
</blockquote>
<p>the problem is that <code>get_mut</code> takes <code>&amp; mut [T]</code>... so at that point you are promising "no other pointers exist to this memory", which is in conflict with the mutable refs handed out by the iterator before. At least that is the current interpretation in Stacked Borrows. I have some thoughts for being less strict here, but no time to work on them for the next few months...</p>



<a name="215968034"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215968034" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Diggsey <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215968034">(Nov 07 2020 at 18:48)</a>:</h4>
<blockquote>
<p>the problem is that get_mut takes &amp; mut [T]</p>
</blockquote>
<p>But <code>IndexMut</code> also takes <code>self: &amp;mut [T]</code>, so why is that different?</p>



<a name="215971143"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215971143" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215971143">(Nov 07 2020 at 20:08)</a>:</h4>
<p><code>name.field[index]</code> lowers to a primitive slice access on the MIR level, no <code>IndexMut</code> involved</p>



<a name="215971153"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215971153" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215971153">(Nov 07 2020 at 20:08)</a>:</h4>
<p>for the model as it is implemented so far, that makes a huge difference -- primitive operations can be tracked precisely</p>



<a name="215971241"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215971241" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215971241">(Nov 07 2020 at 20:10)</a>:</h4>
<p><a href="https://github.com/rust-lang/unsafe-code-guidelines/issues/133">there is an open issue</a> that the current model might be too aggressive in how it interprets <code>&amp;mut</code></p>



<a name="215971258"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215971258" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215971258">(Nov 07 2020 at 20:11)</a>:</h4>
<p>some time in 2021 I hope to explore alternative models that are more permissive</p>



<a name="215971564"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215971564" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Diggsey <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215971564">(Nov 07 2020 at 20:19)</a>:</h4>
<p>Hmm, I don't like that... There are certain things that I expect to have no effect on a program's correctness (like introducing new-type wrappers).<br>
There are also some edge-cases with generics and dyn Trait. I'm guessing in a generic context, it only matters whether it monomorphises to a primitive slice access, and if used via <code>dyn IndexMut</code> it never counts as a primitive slice access even if the underlying type is a slice?</p>



<a name="215971722"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215971722" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215971722">(Nov 07 2020 at 20:22)</a>:</h4>
<blockquote>
<p>and if used via dyn IndexMut it never counts as a primitive slice access even if the underlying type is a slice?</p>
</blockquote>
<p>I did not check, but I assume this to be the case</p>



<a name="215971737"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined%20behavior%20detected%20by%20miri/near/215971737" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Undefined.20behavior.20detected.20by.20miri.html#215971737">(Nov 07 2020 at 20:23)</a>:</h4>
<p>It certainly is not ideal. Future exploration will have to show if we can find a model that does not have these problems, but still permits all/most of the desired optimizations.</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>